1--TEST-- 2Bug #81713 (OpenSSL functions null byte injection) 3--SKIPIF-- 4<?php 5if (!extension_loaded("openssl")) die("skip openssl not loaded"); 6?> 7--FILE-- 8<?php 9$priv_key_file = "file://" . __DIR__ . "/private_rsa_1024.key"; 10$priv_key_file_null = "$priv_key_file\x00foo"; 11$crt = __DIR__ . '/cert.crt'; 12$crt_null = "$crt\x00foo"; 13$csr = __DIR__ . '/cert.csr'; 14$crt_file = "file://$crt"; 15$crt_file_null = "$crt_file\x00foo"; 16$csr_file = "file://$csr"; 17$csr_file_null = "$csr_file\x00foo"; 18$infile = __DIR__ . '/plain.txt'; 19$infile_null = "$infile\x00acd";; 20$outfile = __DIR__ . '/bug81713.out'; 21$outfile_null = "$outfile\x00acd"; 22$eml = __DIR__ . "/signed.eml"; 23$eml_null = "$eml\x00foo"; 24$headers = ["test@test", "testing openssl_cms_encrypt()"]; 25$cainfo = [$crt]; 26$cainfo_null = [$crt_file_null]; 27 28$config = __DIR__ . DIRECTORY_SEPARATOR . 'openssl.cnf'; 29$config_arg = array('config' => $config); 30 31$dn = [ 32 "countryName" => "BR", 33 "stateOrProvinceName" => "Rio Grande do Sul", 34 "localityName" => "Porto Alegre", 35 "commonName" => "Henrique do N. Angelo", 36 "emailAddress" => "hnangelo@php.net" 37]; 38 39$csr_args = [ 40 "digest_alg" => "sha256", 41 "private_key_bits" => 2048, 42 "private_key_type" => OPENSSL_KEYTYPE_DSA, 43 "encrypt_key" => true, 44 "config" => $config, 45]; 46 47$tests = [ 48 ["openssl_pkey_get_public", $crt_file], 49 ["openssl_pkey_get_public", $crt_file_null], 50 ["openssl_pkey_get_private", $crt_file_null], 51 ["openssl_pkey_export_to_file", $priv_key_file_null, $outfile], 52 ["openssl_pkey_export_to_file", $priv_key_file, $outfile_null], 53 ["openssl_pkey_export", $priv_key_file_null, &$out], 54 ["openssl_pkey_derive", $priv_key_file_null, $priv_key_file], 55 ["openssl_pkey_derive", $priv_key_file, $priv_key_file_null], 56 ["openssl_private_encrypt", "test", &$out, $priv_key_file_null], 57 ["openssl_private_decrypt", "test", &$out, $priv_key_file_null], 58 ["openssl_public_encrypt", "test", &$out, $priv_key_file_null], 59 ["openssl_public_decrypt", "test", &$out, $priv_key_file_null], 60 ["openssl_sign", "test", &$out, $priv_key_file_null], 61 ["openssl_verify", "test", "sig", $priv_key_file_null], 62 ["openssl_seal", "test", &$sealed, &$ekeys, [$priv_key_file_null], "AES-128-CBC", &$iv], 63 ["openssl_open", "test", &$open, "aaa", $priv_key_file_null, "AES-128-CBC", &$iv], 64 ["openssl_csr_new", $dn, &$priv_key_file_null, $csr_args], 65 ["openssl_csr_get_subject", $csr_file_null], 66 ["openssl_csr_get_public_key", $csr_file_null], 67 ["openssl_x509_fingerprint", $crt_file_null], 68 ["openssl_x509_export_to_file", $crt_file_null, $outfile], 69 ["openssl_x509_export_to_file", $crt_file, $outfile_null], 70 ["openssl_x509_export", $crt_file_null, &$out], 71 ["openssl_x509_checkpurpose", $crt_file_null, X509_PURPOSE_SSL_CLIENT], 72 ["openssl_x509_checkpurpose", $crt_file, X509_PURPOSE_SSL_CLIENT, $cainfo_null], 73 ["openssl_x509_check_private_key", $crt_file_null, $priv_key_file], 74 ["openssl_x509_check_private_key", $crt_file, $priv_key_file_null], 75 ["openssl_x509_verify", $crt_file_null, $priv_key_file], 76 ["openssl_x509_verify", $crt_file, $priv_key_file_null], 77 ["openssl_x509_parse", $crt_file_null], 78 ["openssl_x509_read", $crt_file_null], 79 ["openssl_cms_encrypt", $infile_null, $outfile, $crt_file, $headers], 80 ["openssl_cms_encrypt", $infile, $outfile_null, $crt_file, $headers], 81 ["openssl_cms_encrypt", $infile, $outfile, $crt_file_null, $headers], 82 ["openssl_cms_encrypt", $infile, $outfile, $cainfo_null, $headers], 83 ["openssl_cms_decrypt", $infile_null, $outfile, $crt_file, $priv_key_file], 84 ["openssl_cms_decrypt", $infile, $outfile_null, $crt_file, $priv_key_file], 85 ["openssl_cms_decrypt", $infile, $outfile, $crt_file_null, $priv_key_file], 86 ["openssl_cms_decrypt", $infile, $outfile, $crt_file, $priv_key_file_null], 87 ["openssl_cms_sign", $infile_null, "$outfile", $crt_file, $priv_key_file, $headers], 88 ["openssl_cms_sign", $infile, $outfile_null, $crt_file, $priv_key_file, $headers], 89 ["openssl_cms_sign", $infile, $outfile, $crt_file_null, $priv_key_file, $headers], 90 ["openssl_cms_sign", $infile, $outfile, $crt_file, $crt_file_null, $headers], 91 ["openssl_cms_sign", $infile, $outfile, $crt_file, $crt_file, $headers, 0, OPENSSL_ENCODING_DER, $crt_file_null], 92 ["openssl_cms_verify", $eml_null, OPENSSL_CMS_NOVERIFY, $outfile, $cainfo, $outfile, $outfile, $outfile], 93 ["openssl_cms_verify", $eml, OPENSSL_CMS_NOVERIFY, $outfile_null, $cainfo, $outfile, $outfile, $outfile], 94 ["openssl_cms_verify", $eml, OPENSSL_CMS_NOVERIFY, $outfile, $cainfo_null], 95 ["openssl_cms_verify", $eml, OPENSSL_CMS_NOVERIFY, $outfile, $cainfo, $outfile_null, $outfile, $outfile], 96 ["openssl_cms_verify", $eml, OPENSSL_CMS_NOVERIFY, $outfile, $cainfo, $outfile, $outfile_null, $outfile], 97 ["openssl_cms_verify", $eml, OPENSSL_CMS_NOVERIFY, $outfile, $cainfo, $outfile, $outfile, $outfile_null], 98 ["openssl_pkcs7_encrypt", $infile_null, $outfile, $crt_file, $headers], 99 ["openssl_pkcs7_encrypt", $infile, $outfile_null, $crt_file, $headers], 100 ["openssl_pkcs7_encrypt", $infile, $outfile, $crt_file_null, $headers], 101 ["openssl_pkcs7_encrypt", $infile, $outfile, $cainfo_null, $headers], 102 ["openssl_pkcs7_decrypt", $infile_null, $outfile, $crt_file, $priv_key_file], 103 ["openssl_pkcs7_decrypt", $infile, $outfile_null, $crt_file, $priv_key_file], 104 ["openssl_pkcs7_decrypt", $infile, $outfile, $crt_file_null, $priv_key_file], 105 ["openssl_pkcs7_decrypt", $infile, $outfile, $crt_file, $priv_key_file_null], 106 ["openssl_pkcs7_sign", $infile_null, "$outfile", $crt_file, $priv_key_file, $headers], 107 ["openssl_pkcs7_sign", $infile, $outfile_null, $crt_file, $priv_key_file, $headers], 108 ["openssl_pkcs7_sign", $infile, $outfile, $crt_file_null, $priv_key_file, $headers], 109 ["openssl_pkcs7_sign", $infile, $outfile, $crt_file, $crt_file_null, $headers], 110 ["openssl_pkcs7_sign", $infile, $outfile, $crt_file, $crt_file, $headers, 0, $crt_file_null], 111 ["openssl_pkcs7_verify", $eml_null, 0, $outfile, $cainfo, $outfile, $outfile, $outfile], 112 ["openssl_pkcs7_verify", $eml, 0, $outfile_null, $cainfo, $outfile, $outfile, $outfile], 113 ["openssl_pkcs7_verify", $eml, 0, $outfile, $cainfo_null], 114 ["openssl_pkcs7_verify", $eml, 0, $outfile, $cainfo, $outfile_null, $outfile, $outfile], 115 ["openssl_pkcs7_verify", $eml, 0, $outfile, $cainfo, $outfile, $outfile_null, $outfile], 116 ["openssl_pkcs7_verify", $eml, 0, $outfile, $cainfo, $outfile, $outfile, $outfile_null], 117 ["openssl_pkcs12_export", $crt_file_null, &$out, $priv_key_file, "pwd"], 118 ["openssl_pkcs12_export", $crt_file, &$out, $priv_key_file_null, "pwd"], 119 ["openssl_pkcs12_export", $crt_file, &$out, $priv_key_file, "pwd", ["extracerts" => [$crt_file_null]]], 120 ["openssl_pkcs12_export_to_file", $crt_file_null, $outfile, $priv_key_file, "pwd"], 121 ["openssl_pkcs12_export_to_file", $crt_file, $outfile_null, $priv_key_file_null, "pwd"], 122 ["openssl_pkcs12_export_to_file", $crt_file, $outfile, $priv_key_file_null, "pwd"], 123 ["openssl_pkcs12_export_to_file", $crt_file, $outfile, $priv_key_file, "pwd", ["extracerts" => [$crt_file_null]]], 124]; 125foreach ($tests as $test) { 126 try { 127 $key = call_user_func_array($test[0], array_slice($test, 1)); 128 var_dump($key); 129 } 130 catch (ValueError $e) { 131 echo $e->getMessage() . PHP_EOL; 132 } 133} 134?> 135--CLEAN-- 136<?php 137$outfile = __DIR__ . '/bug81713.out'; 138@unlink($outfile); 139?> 140--EXPECTF-- 141object(OpenSSLAsymmetricKey)#1 (0) { 142} 143openssl_pkey_get_public(): Argument #1 ($public_key) must not contain any null bytes 144openssl_pkey_get_private(): Argument #1 ($private_key) must not contain any null bytes 145openssl_pkey_export_to_file(): Argument #1 ($key) must not contain any null bytes 146openssl_pkey_export_to_file(): Argument #2 ($output_filename) must not contain any null bytes 147openssl_pkey_export(): Argument #1 ($key) must not contain any null bytes 148openssl_pkey_derive(): Argument #1 ($public_key) must not contain any null bytes 149openssl_pkey_derive(): Argument #2 ($private_key) must not contain any null bytes 150openssl_private_encrypt(): Argument #3 ($private_key) must not contain any null bytes 151openssl_private_decrypt(): Argument #3 ($private_key) must not contain any null bytes 152openssl_public_encrypt(): Argument #3 ($public_key) must not contain any null bytes 153openssl_public_decrypt(): Argument #3 ($public_key) must not contain any null bytes 154openssl_sign(): Argument #3 ($private_key) must not contain any null bytes 155openssl_verify(): Argument #3 ($public_key) must not contain any null bytes 156openssl_seal(): Argument #4 ($public_key) must not contain any null bytes 157openssl_open(): Argument #4 ($private_key) must not contain any null bytes 158openssl_csr_new(): Argument #2 ($private_key) must not contain any null bytes 159openssl_csr_get_subject(): Argument #1 ($csr) must not contain any null bytes 160openssl_csr_get_public_key(): Argument #1 ($csr) must not contain any null bytes 161 162Warning: openssl_x509_fingerprint(): X.509 Certificate cannot be retrieved in %s on line %d 163openssl_x509_fingerprint(): Argument #1 ($certificate) must not contain any null bytes 164 165Warning: openssl_x509_export_to_file(): X.509 Certificate cannot be retrieved in %s on line %d 166openssl_x509_export_to_file(): Argument #1 ($certificate) must not contain any null bytes 167openssl_x509_export_to_file(): Argument #2 ($output_filename) must not contain any null bytes 168 169Warning: openssl_x509_export(): X.509 Certificate cannot be retrieved in %s on line %d 170openssl_x509_export(): Argument #1 ($certificate) must not contain any null bytes 171openssl_x509_checkpurpose(): Argument #1 ($certificate) must not contain any null bytes 172openssl_x509_checkpurpose(): Argument #3 ($ca_info) array item must not contain any null bytes 173openssl_x509_check_private_key(): Argument #1 ($certificate) must not contain any null bytes 174openssl_x509_check_private_key(): Argument #2 ($private_key) must not contain any null bytes 175openssl_x509_verify(): Argument #1 ($certificate) must not contain any null bytes 176openssl_x509_verify(): Argument #2 ($public_key) must not contain any null bytes 177openssl_x509_parse(): Argument #1 ($certificate) must not contain any null bytes 178 179Warning: openssl_x509_read(): X.509 Certificate cannot be retrieved in %s on line %d 180openssl_x509_read(): Argument #1 ($certificate) must not contain any null bytes 181openssl_cms_encrypt(): Argument #1 ($input_filename) must not contain any null bytes 182openssl_cms_encrypt(): Argument #2 ($output_filename) must not contain any null bytes 183openssl_cms_encrypt(): Argument #3 ($certificate) must not contain any null bytes 184openssl_cms_encrypt(): Argument #3 ($certificate) array item must not contain any null bytes 185openssl_cms_decrypt(): Argument #1 ($input_filename) must not contain any null bytes 186openssl_cms_decrypt(): Argument #2 ($output_filename) must not contain any null bytes 187 188Warning: openssl_cms_decrypt(): X.509 Certificate cannot be retrieved in %s on line %d 189openssl_cms_decrypt(): Argument #3 ($certificate) must not contain any null bytes 190openssl_cms_decrypt(): Argument #4 ($private_key) must not contain any null bytes 191openssl_cms_sign(): Argument #1 ($input_filename) must not contain any null bytes 192openssl_cms_sign(): Argument #2 ($output_filename) must not contain any null bytes 193 194Warning: openssl_cms_sign(): X.509 Certificate cannot be retrieved in %s on line %d 195openssl_cms_sign(): Argument #3 ($certificate) must not contain any null bytes 196openssl_cms_sign(): Argument #4 ($private_key) must not contain any null bytes 197openssl_cms_sign(): Argument #8 ($untrusted_certificates_filename) must not contain any null bytes 198openssl_cms_verify(): Argument #1 ($input_filename) must not contain any null bytes 199openssl_cms_verify(): Argument #3 ($certificates) must not contain any null bytes 200openssl_cms_verify(): Argument #4 ($ca_info) array item must not contain any null bytes 201openssl_cms_verify(): Argument #5 ($untrusted_certificates_filename) must not contain any null bytes 202openssl_cms_verify(): Argument #6 ($content) must not contain any null bytes 203openssl_cms_verify(): Argument #7 ($pk7) must not contain any null bytes 204openssl_pkcs7_encrypt(): Argument #1 ($input_filename) must not contain any null bytes 205openssl_pkcs7_encrypt(): Argument #2 ($output_filename) must not contain any null bytes 206openssl_pkcs7_encrypt(): Argument #3 ($certificate) must not contain any null bytes 207openssl_pkcs7_encrypt(): Argument #3 ($certificate) array item must not contain any null bytes 208openssl_pkcs7_decrypt(): Argument #1 ($input_filename) must not contain any null bytes 209openssl_pkcs7_decrypt(): Argument #2 ($output_filename) must not contain any null bytes 210 211Warning: openssl_pkcs7_decrypt(): X.509 Certificate cannot be retrieved in %s on line %d 212openssl_pkcs7_decrypt(): Argument #3 ($certificate) must not contain any null bytes 213openssl_pkcs7_decrypt(): Argument #4 ($private_key) must not contain any null bytes 214openssl_pkcs7_sign(): Argument #1 ($input_filename) must not contain any null bytes 215openssl_pkcs7_sign(): Argument #2 ($output_filename) must not contain any null bytes 216 217Warning: openssl_pkcs7_sign(): X.509 Certificate cannot be retrieved in %s on line %d 218openssl_pkcs7_sign(): Argument #3 ($certificate) must not contain any null bytes 219openssl_pkcs7_sign(): Argument #4 ($private_key) must not contain any null bytes 220openssl_pkcs7_sign(): Argument #7 ($untrusted_certificates_filename) must not contain any null bytes 221openssl_pkcs7_verify(): Argument #1 ($input_filename) must not contain any null bytes 222openssl_pkcs7_verify(): Argument #3 ($signers_certificates_filename) must not contain any null bytes 223openssl_pkcs7_verify(): Argument #4 ($ca_info) array item must not contain any null bytes 224openssl_pkcs7_verify(): Argument #5 ($untrusted_certificates_filename) must not contain any null bytes 225openssl_pkcs7_verify(): Argument #6 ($content) must not contain any null bytes 226openssl_pkcs7_verify(): Argument #7 ($output_filename) must not contain any null bytes 227 228Warning: openssl_pkcs12_export(): X.509 Certificate cannot be retrieved in %s on line %d 229openssl_pkcs12_export(): Argument #1 ($certificate) must not contain any null bytes 230openssl_pkcs12_export(): Argument #3 ($private_key) must not contain any null bytes 231openssl_pkcs12_export(): Argument #5 ($options) option extracerts array item must not contain any null bytes 232 233Warning: openssl_pkcs12_export_to_file(): X.509 Certificate cannot be retrieved in %s on line %d 234openssl_pkcs12_export_to_file(): Argument #1 ($certificate) must not contain any null bytes 235openssl_pkcs12_export_to_file(): Argument #2 ($output_filename) must not contain any null bytes 236openssl_pkcs12_export_to_file(): Argument #3 ($private_key) must not contain any null bytes 237openssl_pkcs12_export_to_file(): Argument #5 ($options) option extracerts array item must not contain any null bytes 238
